Overview
- Proofpoint publicly disclosed on Thursday that a cluster it calls TA419 used impersonation and phishing to try to steal email credentials from AI experts.
- The attackers focused on people at think tanks, universities, and law firms who work on AI export controls, military uses of AI, and policy strategy.
- Proofpoint says the campaign used credible lures such as emails claiming to come from Lynne Parker and a senior Anthropic employee and followed up with malware-laced documents or fake OneDrive pages that capture passwords.
- The firm attributed the activity to a China-aligned threat actor based on the malware used, internet infrastructure, and consistent targeting patterns while Beijing has not accepted such accusations.
- Investigators found no confirmed successful breaches in the cases disclosed but warned the activity may be wider and persistent, spurring calls for stronger protections, better account hygiene, and faster cross-sector threat sharing to safeguard policy work and private communications.